Smart Cash on Delivery Fraud Blocker & OTP Verification for WooCommerce
COD Rules Dashboard — block and allow rule groups
Fake COD orders costing your store money?
Returned shipments, wasted delivery costs, inventory stuck in transit — this plugin stops fraud at checkout before a single penny is spent on shipping.
Built by The Plugin Forge.
What It Does
Visual Rule Builder — Create rules to block or allow COD based on conditions like cart value, country, state, postal code, schedule, user role, product, category, coupon, or weight. No code needed.
OTP Phone Verification — Customers verify their phone number via SMS before placing a COD order. Supports Twilio, Vonage, and custom webhooks.
Auto-Blacklist — Automatically blocks customers who exceed a set number of failed deliveries or cancellations.
Manual Blacklist — Block any email or phone number with one click.
Fraud Logs — Every blocked attempt is logged with full detail — who, what, where, and why.
Test Simulator — Test your rules against any scenario before going live.
Admin Approval — Hold suspicious orders for manual review.
Fraud Heatmap — See where COD fraud is coming from geographically.
How Rules Work
Go to WooCommerce Smart COD Control COD Rules.
- Click Add New Rule (or pick a quick-start preset)
- Choose action: Block COD when conditions match, or Allow COD only when conditions match
- Choose match mode: All conditions must match (AND), or any one condition (OR)
- Add conditions and save
Rules are evaluated at checkout in order. If no rules exist, COD is available to everyone.
Built and maintained by The Plugin Forge.
Privacy
- Blocked order data (email, phone, IP, location, reason) is stored in your WordPress database only
- OTP SMS is sent via your chosen provider — no data goes to The Plugin Forge
- Review notice stores plugin install date and dismissal state in
wp_options— no data sent externally - Deactivation survey: if you choose to submit feedback, the selected reason, optional details, plugin version, WordPress version, WooCommerce version, and your site URL are sent to The Plugin Forge (thepluginforge.com) to help improve the plugin. Clicking “Skip & Deactivate” sends nothing.
- No external tracking, no cookies, no analytics
- All data permanently deleted on plugin removal via uninstall.php